The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.

The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.

The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.

The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.

The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.

IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.

The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.

The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.

The check-email plugin before 0.5.2 for WordPress has XSS.

An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.

The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.

The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.

The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.

The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.

The ebook-download plugin before 1.2 for WordPress has directory traversal.

The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.